CVE-2021-39223

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is upgraded to 3.8.6 or 4.2.3. As a workaround, disable the Richdocuments application in the app settings.

• CWE-200

• https://github.com/nextcloud/richdocuments/pull/1760Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rjcc-4cgj-6v93Third Party Advisory
• https://hackerone.com/reports/1253460Permissions Required, Third Party Advisory
• https://github.com/nextcloud/richdocuments/pull/1760Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rjcc-4cgj-6v93Third Party Advisory
• https://hackerone.com/reports/1253460Permissions Required, Third Party Advisory

Published

Oct 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39218Wasmtime is an open source runtime for WebAssembly & WASI. I…6.3
• CVE-2021-39219Wasmtime is an open source runtime for WebAssembly & WASI. W…6.3
• CVE-2021-3922A race condition vulnerability was reported in IMController,…7
• CVE-2021-39220Nextcloud is an open-source, self-hosted productivity platfo…3.5
• CVE-2021-39221Nextcloud is an open-source, self-hosted productivity platfo…5.4
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39224Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39225Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39227ZRender is a lightweight graphic library providing 2d draw f…9.8
• CVE-2021-39228Tremor is an event processing system for unstructured data. …9.8
• CVE-2021-39229Apprise is an open source library which allows you to send a…7.5